Page 1 of 1

[SOLVED] Recovering LUKS encrypted files and folders

Posted: 20 Feb 2018, 21:52
by peldritch
Hello,
I have been trying to wrap my head around my problem (and potential solutions), with mixed success, so please forgive me if I include irrelevant information. I am trying to recover my /home folder that was somehow damaged. It is LUKS encrypted LVM partition. I can mount and decrypt this disk, but I can't see any of my files! There are folders labeled .ecryptfs and .Private, but I don't know what to do with them. I have run photorec on this drive, and among the thousands of files it found, are many with .ecryptfs file extensions. I believe these contain the files from my home folder that I wish to recover. I don't understand why they remain encrypted, even after mounting the drive with my passphrase... or what further steps I may take to access them :( As far as I can tell, my LUKS header is intact.

In case it gives any insight, I will explain what happened prior to this problem. I was attempting to make a bootable usb. I used the dd command to write an image to /dev/sdb, whereupon my computer completely froze. I rebooted via Alt+PrtSc+REISUB. During boot, I was prompted for my disk password, I entered it, the computer booted and I was presented with my user name at the login screen. When I entered my password, I got an error about my .dmrc file permissions, and was unable to continue. I went to a shell prompt where I was able to log in, and ls my home directory but it didn't show any of my files! The only folder there was a mount point for a network share.

I really don't want to give up on these files yet, and I sense they are not totally lost, but I have reached the limit of what I can do without some help. My next project will be a robust backup regime! Thanks for reading, and I appreciate any help anyone can provide me.

Re: Recovering LUKS encrypted files and folders

Posted: 22 Feb 2018, 06:53
by cgrenier
ecryptfs is a file level encryption system, it can be used on top of LUKS.
See viewtopic.php?f=7&t=7535

Re: Recovering LUKS encrypted files and folders

Posted: 22 Feb 2018, 09:16
by peldritch
Thanks for your reply. I think I jumped to conclusions, and assumed my data had been overwritten. I didn't realize ecryptfs was how my /home was encrypted, and assumed it was a peculiarity of the recovery tools. After reading the link you shared, and some trial and error, I ran

sudo ecryptfs-recover-private .Private/

And it worked! I am so happy to see all my files again after a week of feeling doomed. Thanks for helping me, even though my problem was tangential to your software.